@lore-co/cli 0.1.18 → 0.1.19

package/dist/cli.js

@@ -1,11 +1,13 @@
 #!/usr/bin/env node
 import { access, chmod, copyFile, mkdir, open, readFile, readdir, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { constants as fsConstants, realpathSync } from "node:fs";
+import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { delimiter, dirname, resolve } from "node:path";
-import { homedir, platform } from "node:os";
+import { homedir, hostname, platform } from "node:os";
+import { setTimeout as delay } from "node:timers/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { CLAUDE_RELIABILITY_INTEGRATION, CODEX_RELIABILITY_INTEGRATION, CURSOR_RELIABILITY_INTEGRATION, NATIVE_CODING_AGENT_NAMES, OPENCODE_RELIABILITY_INTEGRATION, OperationalMetricsResponseSchema, POLYTOKEN_RELIABILITY_INTEGRATION, RELIABILITY_INTEGRATION_CONTRACT_VERSION, ReliabilityInvocationRecordSchema, WorkspaceIdentityResponseSchema, canonicalJson, deriveReliabilityInvocationHealth, isNativeCodingAgent, } from "@lore-co/core";
+import { CLAUDE_RELIABILITY_INTEGRATION, CODEX_RELIABILITY_INTEGRATION, COPILOT_CLI_RELIABILITY_INTEGRATION, COPILOT_CLOUD_MCP_RELIABILITY_INTEGRATION, COPILOT_VSCODE_PREVIEW_RELIABILITY_INTEGRATION, CreateDeviceAuthorizationResponseSchema, CURSOR_RELIABILITY_INTEGRATION, NATIVE_CODING_AGENT_NAMES, OPENCODE_RELIABILITY_INTEGRATION, OperationalMetricsResponseSchema, PollDeviceAuthorizationResponseSchema, POLYTOKEN_RELIABILITY_INTEGRATION, RELIABILITY_INTEGRATION_CONTRACT_VERSION, ReliabilityInvocationRecordSchema, WorkspaceIdentityResponseSchema, canonicalJson, deriveReliabilityInvocationHealth, isNativeCodingAgent, } from "@lore-co/core";
 import { runHook, } from "./runtime.js";
 import { readInvocationHealthWriteInput, runInvocationHealthWrite, } from "./invocation-health-writer.js";
 import { runAskCommand } from "./ask.js";
@@ -44,9 +46,26 @@ const POLYTOKEN_HOOK_EVENTS = [
     "pre_user_prompt",
     "post_model_turn",
 ];
+const COPILOT_CLI_HOOK_EVENTS = [
+    "userPromptTransformed",
+    "preToolUse",
+    "agentStop",
+    "sessionEnd",
+];
+const EXTERNAL_SURFACES = [
+    {
+        surface: "copilot-cloud-mcp",
+        integrationId: COPILOT_CLOUD_MCP_RELIABILITY_INTEGRATION.integrationId,
+        installation: "repository_template",
+        locallyInspectable: false,
+        capabilities: COPILOT_CLOUD_MCP_RELIABILITY_INTEGRATION.capabilities,
+    },
+];
 const AGENT_MANIFESTS = {
     claude: CLAUDE_RELIABILITY_INTEGRATION,
     codex: CODEX_RELIABILITY_INTEGRATION,
+    "copilot-cli": COPILOT_CLI_RELIABILITY_INTEGRATION,
+    "copilot-vscode": COPILOT_VSCODE_PREVIEW_RELIABILITY_INTEGRATION,
     cursor: CURSOR_RELIABILITY_INTEGRATION,
     opencode: OPENCODE_RELIABILITY_INTEGRATION,
     polytoken: POLYTOKEN_RELIABILITY_INTEGRATION,
@@ -102,21 +121,26 @@ Examples:
   lore devin --help
 `;
 const CONNECT_HELP = `lore connect
-Store a workspace credential and idempotently install agent integrations.
+Authorize this device and idempotently install agent integrations.
 
 Usage:
+  lore connect --login [options]
   lore connect --token <token> [options]
 
 Options:
   --url <url>           Lore API base URL (default: https://api.uselore.co)
   --dashboard-url <url> Lore dashboard URL (default: https://uselore.co for hosted Lore)
+  --login               Approve access securely in the Lore dashboard
+  --no-open             Print the approval URL without opening a browser
   --token <token>       Workspace bearer token (or LORE_WORKSPACE_TOKEN/LORE_TOKEN)
-  --agent <name>        claude, codex, cursor, opencode, polytoken, or t3code; repeat to override auto-detection
+  --agent <name>        claude, codex, copilot, copilot-cli, copilot-vscode, cowork, cursor, opencode, polytoken, or t3code
   --timeout-ms <ms>     Hook request timeout, 250-10000 (default: 2500)
   --json                Print machine-readable output
   --help                Show this command's help
 
 Examples:
+  lore connect --login --agent claude
+  lore connect --login --agent cowork
   lore connect --token "$LORE_WORKSPACE_TOKEN" --agent claude
   lore connect --url http://localhost:3004 --token dev-token --agent codex
   lore connect --token "$LORE_WORKSPACE_TOKEN" --agent cursor
@@ -167,6 +191,7 @@ export function getLorePaths(home, environment = process.env) {
         ? resolve(resolvedHome, ".config")
         : resolve(environment.XDG_CONFIG_HOME);
     const t3Home = resolve(environment.T3CODE_HOME?.trim() || resolve(resolvedHome, ".t3"));
+    const copilotHome = resolve(environment.COPILOT_HOME?.trim() || resolve(resolvedHome, ".copilot"));
     return {
         home: resolvedHome,
         loreDirectory,
@@ -183,6 +208,9 @@ export function getLorePaths(home, environment = process.env) {
         state: resolve(loreDirectory, "state"),
         queue: resolve(loreDirectory, "queue"),
         codexHooks: resolve(resolvedHome, ".codex", "hooks.json"),
+        copilotCliHooks: resolve(copilotHome, "hooks", "lore.json"),
+        copilotVscodeHooks: resolve(environment.LORE_COPILOT_VSCODE_HOOKS?.trim() ||
+            resolve(process.cwd(), ".github", "hooks", "lore-vscode.json")),
         claudeSettings: resolve(resolvedHome, ".claude", "settings.json"),
         cursorHooks: resolve(resolvedHome, ".cursor", "hooks.json"),
         cursorUserData: platform() === "darwin"
@@ -200,14 +228,18 @@ function isConfiguredAgent(value) {
     return typeof value === "string" && isNativeCodingAgent(value);
 }
 function isConnectAgent(value) {
-    return isConfiguredAgent(value) || value === "t3code";
+    return (isConfiguredAgent(value) ||
+        value === "copilot" ||
+        value === "cowork" ||
+        value === "t3code");
 }
-function hookCommand(agent, paths) {
+function hookCommand(agent, paths, event) {
     const loreHome = `LORE_HOME=${shellQuote(paths.home)}`;
+    const hookEvent = event === undefined ? "" : ` LORE_HOOK_EVENT=${shellQuote(event)}`;
     if (IS_STANDALONE_BINARY) {
-        return `env -u BUN_OPTIONS -u BUN_BE_BUN ${loreHome} ${shellQuote(process.execPath)} hook --agent ${agent} ${LORE_OWNER_ARGUMENT}`;
+        return `env -u BUN_OPTIONS -u BUN_BE_BUN ${loreHome}${hookEvent} ${shellQuote(process.execPath)} hook --agent ${agent} ${LORE_OWNER_ARGUMENT}`;
     }
-    return `env ${loreHome} ${shellQuote(process.execPath)} ${shellQuote(paths.runtime)} --agent ${agent} ${LORE_OWNER_ARGUMENT}`;
+    return `env ${loreHome}${hookEvent} ${shellQuote(process.execPath)} ${shellQuote(paths.runtime)} --agent ${agent} ${LORE_OWNER_ARGUMENT}`;
 }
 function isLoreHook(value) {
     if (!isObject(value) || value.type !== "command") {
@@ -396,6 +428,169 @@ export function countLoreCursorHooks(input) {
         return count + hooks[event].filter(isLoreHook).length;
     }, 0);
 }
+function copilotCliEventHandler(event, paths) {
+    return {
+        type: "command",
+        bash: hookCommand("copilot-cli", paths, event),
+        timeoutSec: event === "sessionEnd"
+            ? 2
+            : event === "agentStop"
+                ? 3
+                : event === "preToolUse"
+                    ? 10
+                    : 25,
+    };
+}
+function isLoreCopilotHook(value) {
+    if (!isObject(value) || value.type !== "command") {
+        return false;
+    }
+    const command = typeof value.bash === "string"
+        ? value.bash
+        : typeof value.command === "string"
+            ? value.command
+            : "";
+    return (/(?:^|\s)--owner(?:=|\s+)lore(?:\s|$)/u.test(command) ||
+        command.includes("/.lore/bin/lore-hook.mjs"));
+}
+function stripLoreFromCopilotEvent(value) {
+    return Array.isArray(value)
+        ? value.filter((hook) => !isLoreCopilotHook(hook))
+        : [];
+}
+export function mergeLoreCopilotCliHooks(input, paths) {
+    const result = cloneObject(input);
+    if (result.version !== undefined && result.version !== 1) {
+        throw new Error('Copilot hook configuration field "version" must be 1');
+    }
+    if (result.hooks !== undefined && !isObject(result.hooks)) {
+        throw new Error('Copilot hook configuration field "hooks" must be an object');
+    }
+    const hooks = isObject(result.hooks) ? { ...result.hooks } : {};
+    for (const event of COPILOT_CLI_HOOK_EVENTS) {
+        if (hooks[event] !== undefined && !Array.isArray(hooks[event])) {
+            throw new Error(`Copilot hook event "${event}" must be an array`);
+        }
+        hooks[event] = [
+            ...stripLoreFromCopilotEvent(hooks[event]),
+            copilotCliEventHandler(event, paths),
+        ];
+    }
+    result.version = 1;
+    result.hooks = hooks;
+    return result;
+}
+export function removeLoreCopilotCliHooks(input) {
+    const result = cloneObject(input);
+    if (!isObject(result.hooks)) {
+        return result;
+    }
+    const hooks = { ...result.hooks };
+    for (const event of COPILOT_CLI_HOOK_EVENTS) {
+        if (!Array.isArray(hooks[event])) {
+            continue;
+        }
+        const remaining = stripLoreFromCopilotEvent(hooks[event]);
+        if (remaining.length === 0) {
+            delete hooks[event];
+        }
+        else {
+            hooks[event] = remaining;
+        }
+    }
+    if (Object.keys(hooks).length === 0) {
+        delete result.hooks;
+    }
+    else {
+        result.hooks = hooks;
+    }
+    return result;
+}
+export function countLoreCopilotCliHooks(input) {
+    if (!isObject(input.hooks)) {
+        return 0;
+    }
+    return COPILOT_CLI_HOOK_EVENTS.reduce((count, event) => {
+        const hooks = input.hooks;
+        if (!isObject(hooks) || !Array.isArray(hooks[event])) {
+            return count;
+        }
+        return count + hooks[event].filter(isLoreCopilotHook).length;
+    }, 0);
+}
+function copilotVscodeEventHandler(event, paths) {
+    return {
+        type: "command",
+        command: hookCommand("copilot-vscode", paths, event),
+        timeout: event === "SessionEnd"
+            ? 2
+            : event === "Stop"
+                ? 3
+                : event === "PreToolUse"
+                    ? 10
+                    : 25,
+    };
+}
+export function mergeLoreCopilotVscodeHooks(input, paths) {
+    const result = cloneObject(input);
+    if (result.version !== undefined && result.version !== 1) {
+        throw new Error('VS Code Copilot hook field "version" must be 1');
+    }
+    if (result.hooks !== undefined && !isObject(result.hooks)) {
+        throw new Error('VS Code Copilot hook field "hooks" must be an object');
+    }
+    const hooks = isObject(result.hooks) ? { ...result.hooks } : {};
+    for (const event of HOOK_EVENTS) {
+        if (hooks[event] !== undefined && !Array.isArray(hooks[event])) {
+            throw new Error(`VS Code Copilot hook event "${event}" must be an array`);
+        }
+        hooks[event] = [
+            ...stripLoreFromCursorEvent(hooks[event]),
+            copilotVscodeEventHandler(event, paths),
+        ];
+    }
+    result.version = 1;
+    result.hooks = hooks;
+    return result;
+}
+export function removeLoreCopilotVscodeHooks(input) {
+    const result = cloneObject(input);
+    if (!isObject(result.hooks)) {
+        return result;
+    }
+    const hooks = { ...result.hooks };
+    for (const event of HOOK_EVENTS) {
+        if (!Array.isArray(hooks[event])) {
+            continue;
+        }
+        const remaining = stripLoreFromCursorEvent(hooks[event]);
+        if (remaining.length === 0) {
+            delete hooks[event];
+        }
+        else {
+            hooks[event] = remaining;
+        }
+    }
+    if (Object.keys(hooks).length === 0) {
+        delete result.hooks;
+    }
+    else {
+        result.hooks = hooks;
+    }
+    return result;
+}
+export function countLoreCopilotVscodeHooks(input) {
+    if (!isObject(input.hooks)) {
+        return 0;
+    }
+    return HOOK_EVENTS.reduce((count, event) => {
+        const hooks = input.hooks;
+        if (!isObject(hooks) || !Array.isArray(hooks[event])) {
+            return count;
+        }
+        return count + hooks[event].filter(isLoreHook).length;
+    }, 0);
+}
 function polytokenEventHandler(event, paths) {
     return {
         name: `lore-${event.replaceAll("_", "-")}`,
@@ -536,6 +731,54 @@ function cursorInstallationUnits(input, paths, index, total) {
         };
     });
 }
+function copilotCliInstallationUnits(input, paths, index, total) {
+    const configuration = objectConfiguration(input, "copilot-cli");
+    if (configuration.version !== undefined && configuration.version !== 1) {
+        throw new Error('Copilot hook configuration field "version" must be 1');
+    }
+    if (configuration.hooks !== undefined && !isObject(configuration.hooks)) {
+        throw new Error('Copilot hook configuration field "hooks" must be an object');
+    }
+    const hooks = isObject(configuration.hooks) ? configuration.hooks : {};
+    return COPILOT_CLI_HOOK_EVENTS.map((event) => {
+        const values = hooks[event];
+        if (values !== undefined && !Array.isArray(values)) {
+            throw new Error(`Copilot hook event "${event}" must be an array`);
+        }
+        const candidates = Array.isArray(values) ? values : [];
+        const expected = copilotCliEventHandler(event, paths);
+        const ownedCount = candidates.filter(isLoreCopilotHook).length;
+        const exactCount = candidates.filter((candidate) => exactConfiguration(candidate, expected)).length;
+        return {
+            id: installationUnitId(event, index, total),
+            state: installationUnitState(ownedCount, exactCount),
+        };
+    });
+}
+function copilotVscodeInstallationUnits(input, paths, index, total) {
+    const configuration = objectConfiguration(input, "copilot-vscode");
+    if (configuration.version !== undefined && configuration.version !== 1) {
+        throw new Error('VS Code Copilot hook field "version" must be 1');
+    }
+    if (configuration.hooks !== undefined && !isObject(configuration.hooks)) {
+        throw new Error('VS Code Copilot hook field "hooks" must be an object');
+    }
+    const hooks = isObject(configuration.hooks) ? configuration.hooks : {};
+    return HOOK_EVENTS.map((event) => {
+        const values = hooks[event];
+        if (values !== undefined && !Array.isArray(values)) {
+            throw new Error(`VS Code Copilot hook event "${event}" must be an array`);
+        }
+        const candidates = Array.isArray(values) ? values : [];
+        const expected = copilotVscodeEventHandler(event, paths);
+        const ownedCount = candidates.filter(isLoreHook).length;
+        const exactCount = candidates.filter((candidate) => exactConfiguration(candidate, expected)).length;
+        return {
+            id: installationUnitId(event, index, total),
+            state: installationUnitState(ownedCount, exactCount),
+        };
+    });
+}
 function polytokenInstallationUnits(input, paths, index, total) {
     if (!Array.isArray(input)) {
         throw new Error("Polytoken hooks must contain a JSON array");
@@ -574,6 +817,10 @@ function inspectInstallationUnits(input, agent, paths, index, total) {
         case "claude":
         case "codex":
             return commandHookInstallationUnits(input, agent, paths, index, total);
+        case "copilot-cli":
+            return copilotCliInstallationUnits(input, paths, index, total);
+        case "copilot-vscode":
+            return copilotVscodeInstallationUnits(input, paths, index, total);
         case "cursor":
             return cursorInstallationUnits(input, paths, index, total);
         case "polytoken":
@@ -883,6 +1130,30 @@ const AGENT_TARGETS = {
         remove: (input) => removeLoreHooks(objectConfiguration(input, "codex")),
         count: (input) => countLoreHooks(objectConfiguration(input, "codex")),
     },
+    "copilot-cli": {
+        integration: "hooks",
+        expected: COPILOT_CLI_HOOK_EVENTS.length,
+        runtimeRequired: true,
+        emptyValue: () => ({}),
+        configPath: (paths) => paths.copilotCliHooks,
+        detect: async (paths) => (await commandExists("copilot")) || pathExists(paths.copilotCliHooks),
+        executable: async () => commandExists("copilot"),
+        merge: (input, paths) => mergeLoreCopilotCliHooks(objectConfiguration(input, "copilot-cli"), paths),
+        remove: (input) => removeLoreCopilotCliHooks(objectConfiguration(input, "copilot-cli")),
+        count: (input) => countLoreCopilotCliHooks(objectConfiguration(input, "copilot-cli")),
+    },
+    "copilot-vscode": {
+        integration: "hooks",
+        expected: HOOK_EVENTS.length,
+        runtimeRequired: true,
+        emptyValue: () => ({}),
+        configPath: (paths) => paths.copilotVscodeHooks,
+        detect: async (paths) => pathExists(paths.copilotVscodeHooks),
+        executable: async () => commandExists("code"),
+        merge: (input, paths) => mergeLoreCopilotVscodeHooks(objectConfiguration(input, "copilot-vscode"), paths),
+        remove: (input) => removeLoreCopilotVscodeHooks(objectConfiguration(input, "copilot-vscode")),
+        count: (input) => countLoreCopilotVscodeHooks(objectConfiguration(input, "copilot-vscode")),
+    },
     cursor: {
         integration: "hooks",
         expected: CURSOR_HOOK_EVENTS.length,
@@ -928,7 +1199,10 @@ async function detectAgents(paths) {
         agent,
         detected: await targetFor(agent).detect(paths),
     })));
-    return detected.flatMap(({ agent, detected: present }) => present ? [agent] : []);
+    const agents = detected.flatMap(({ agent, detected: present }) => present ? [agent] : []);
+    return agents.includes("copilot-cli")
+        ? agents.filter((agent) => agent !== "copilot-vscode")
+        : agents;
 }
 function installationKey(installation) {
     return `${installation.agent}\0${resolve(installation.configPath)}`;
@@ -1088,7 +1362,14 @@ async function readT3CodeProviderInstallations(paths) {
     }
 }
 async function expandConnectInstallations(requested, paths) {
-    const direct = requested.flatMap((agent) => agent === "t3code" ? [] : [defaultInstallation(agent, paths)]);
+    const direct = requested.flatMap((agent) => {
+        if (agent === "cowork" || agent === "t3code") {
+            return [];
+        }
+        return [
+            defaultInstallation(agent === "copilot" ? "copilot-cli" : agent, paths),
+        ];
+    });
     if (!requested.includes("t3code")) {
         return { installations: direct, warnings: [] };
     }
@@ -1203,7 +1484,12 @@ function valueAfter(args, index, flag) {
     return [value, index + 1];
 }
 function parseConnectArguments(args) {
-    const parsed = { agents: [], json: false };
+    const parsed = {
+        agents: [],
+        json: false,
+        login: false,
+        openBrowser: true,
+    };
     for (let index = 0; index < args.length; index += 1) {
         const argument = args[index];
         if (argument === "--help" || argument === "-h") {
@@ -1214,6 +1500,14 @@ function parseConnectArguments(args) {
             parsed.json = true;
             continue;
         }
+        if (argument === "--login") {
+            parsed.login = true;
+            continue;
+        }
+        if (argument === "--no-open") {
+            parsed.openBrowser = false;
+            continue;
+        }
         if (argument !== "--url" &&
             argument !== "--dashboard-url" &&
             argument !== "--token" &&
@@ -1243,9 +1537,17 @@ function parseConnectArguments(args) {
             parsed.agents.push(value);
         }
         else {
-            throw new Error("--agent must be claude, codex, cursor, opencode, polytoken, or t3code");
+            throw new Error("--agent must be claude, codex, copilot, copilot-cli, copilot-vscode, cowork, cursor, opencode, polytoken, or t3code");
         }
     }
+    if (parsed.login && parsed.token !== undefined) {
+        throw new Error("--login and --token cannot be used together");
+    }
+    if ((parsed.agents.includes("copilot-cli") ||
+        parsed.agents.includes("copilot")) &&
+        parsed.agents.includes("copilot-vscode")) {
+        throw new Error("Install either copilot-cli or copilot-vscode in one connection. Both hosts load repository hooks and would invoke Lore twice.");
+    }
     return parsed;
 }
 function parseOutputArguments(args, help, command) {
@@ -1266,38 +1568,26 @@ function parseOutputArguments(args, help, command) {
 function writeResult(value, json, text) {
     process.stdout.write(json ? `${JSON.stringify(value, null, 2)}\n` : text);
 }
-async function connectCommand(args) {
-    const parsed = parseConnectArguments(args);
-    if (parsed === null) {
-        return;
-    }
+export async function connectWithCredential(options) {
     if (platform() !== "darwin" && platform() !== "linux") {
         throw new Error("Lore agent integrations currently support macOS and Linux");
     }
     const paths = getLorePaths();
     const existing = await readConnectorConfig(paths);
-    const hasProvidedToken = parsed.token !== undefined ||
-        (process.env.LORE_WORKSPACE_TOKEN?.trim() ?? "") !== "" ||
-        (process.env.LORE_TOKEN?.trim() ?? "") !== "";
-    const { apiUrl, dashboardUrl } = resolveConnectEndpoints({
-        ...(parsed.apiUrl === undefined ? {} : { apiUrl: parsed.apiUrl }),
-        ...(parsed.dashboardUrl === undefined
-            ? {}
-            : { dashboardUrl: parsed.dashboardUrl }),
-        environment: process.env,
-        existing,
-        preferHostedDefault: hasProvidedToken,
-    });
-    const token = configuredToken(parsed.token, existing);
-    if (token === undefined || token.trim() === "") {
-        throw new Error("Workspace token is required. Use --token <token>, LORE_WORKSPACE_TOKEN, or LORE_TOKEN.");
+    const apiUrl = normalizeApiUrl(options.apiUrl);
+    const dashboardUrl = options.dashboardUrl === undefined
+        ? undefined
+        : normalizeApiUrl(options.dashboardUrl);
+    const token = options.token.trim();
+    if (token === "") {
+        throw new Error("Workspace token cannot be empty");
     }
-    const timeoutMs = parsed.timeoutMs ?? existing?.timeoutMs ?? 2_500;
+    const timeoutMs = options.timeoutMs ?? existing?.timeoutMs ?? 2_500;
     const identity = await authenticatedIdentity(apiUrl, token.trim(), timeoutMs);
-    const requestedExpansion = parsed.agents.length === 0
+    const requestedExpansion = options.agents.length === 0
         ? { installations: [], warnings: [] }
-        : await expandConnectInstallations(parsed.agents, paths);
-    const detectedAgents = parsed.agents.length === 0 ? await detectAgents(paths) : [];
+        : await expandConnectInstallations(options.agents, paths);
+    const detectedAgents = options.agents.length === 0 ? await detectAgents(paths) : [];
     const installations = uniqueInstallations([
         ...configuredInstallations(existing, paths),
         ...requestedExpansion.installations,
@@ -1306,8 +1596,9 @@ async function connectCommand(args) {
     const agents = [
         ...new Set(installations.map((installation) => installation.agent)),
     ].sort();
-    if (agents.length === 0) {
-        throw new Error("No Claude, Codex, Cursor, OpenCode, or Polytoken installation detected. Use --agent <name>; T3 Code users can use --agent t3code.");
+    const credentialOnlyCowork = options.agents.includes("cowork");
+    if (agents.length === 0 && !credentialOnlyCowork) {
+        throw new Error("No Claude, Codex, Copilot CLI, Cursor, OpenCode, or Polytoken installation detected. Use --agent <name>; T3 Code users can use --agent t3code.");
     }
     const now = new Date();
     const documents = new Map();
@@ -1369,17 +1660,154 @@ async function connectCommand(args) {
         await credentialStore.transferPendingTo(reliabilityStore);
     }
     await reliabilityStore.releaseAuthBlocked(now);
-    const result = {
+    return {
         connected: true,
         apiUrl: config.apiUrl,
         identity,
-        agents,
+        agents: credentialOnlyCowork ? [...agents, "cowork"] : agents,
         config: paths.config,
         changedHookFiles,
         backups,
         warnings: requestedExpansion.warnings,
     };
-    writeResult(result, parsed.json, `connected: ${agents.join(", ")}\napi_url: ${config.apiUrl}\nconfig: ${paths.config}\n${requestedExpansion.warnings.map((warning) => `warning: ${warning}\n`).join("")}`);
+}
+async function requestDeviceAuthorization(input) {
+    let response;
+    try {
+        response = await fetch(`${input.apiUrl}/v1/device-authorizations`, {
+            method: "POST",
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                clientName: `Lore CLI on ${hostname()}`,
+                agents: input.agents,
+                expiresInDays: 90,
+            }),
+            signal: AbortSignal.timeout(10_000),
+        });
+    }
+    catch {
+        throw new Error("Lore device authorization is unreachable. Verify --url and retry.");
+    }
+    if (!response.ok) {
+        throw new Error(response.status === 404
+            ? "This Lore server does not support browser approval. Upgrade the server or use --token."
+            : "Lore could not start browser approval. Retry in a moment.");
+    }
+    const authorization = CreateDeviceAuthorizationResponseSchema.safeParse(await response.json().catch(() => null));
+    if (!authorization.success) {
+        throw new Error("Lore returned an incompatible device authorization response.");
+    }
+    const serverApprovalUrl = new URL(authorization.data.verificationUriComplete);
+    const approvalUrl = input.dashboardUrl === undefined
+        ? serverApprovalUrl.toString()
+        : new URL(`${serverApprovalUrl.pathname}${serverApprovalUrl.search}`, `${input.dashboardUrl}/`).toString();
+    process.stderr.write(`Approve Lore access with code ${authorization.data.userCode}:\n${approvalUrl}\n`);
+    if (input.openBrowser) {
+        const command = platform() === "darwin" ? "open" : "xdg-open";
+        const child = spawn(command, [approvalUrl], {
+            detached: true,
+            stdio: "ignore",
+        });
+        child.once("error", () => {
+            // The printed URL remains the safe fallback.
+        });
+        child.unref();
+    }
+    const expiresAt = Date.parse(authorization.data.expiresAt);
+    const intervalMs = authorization.data.intervalSeconds * 1_000;
+    while (Date.now() < expiresAt) {
+        await delay(intervalMs);
+        let pollResponse;
+        try {
+            pollResponse = await fetch(`${input.apiUrl}/v1/device-authorizations/poll`, {
+                method: "POST",
+                headers: {
+                    accept: "application/json",
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify({
+                    deviceCode: authorization.data.deviceCode,
+                }),
+                signal: AbortSignal.timeout(10_000),
+            });
+        }
+        catch {
+            continue;
+        }
+        if (pollResponse.status === 429) {
+            const retryAfter = Number(pollResponse.headers.get("retry-after"));
+            if (Number.isFinite(retryAfter) && retryAfter > 0) {
+                await delay(retryAfter * 1_000);
+            }
+            continue;
+        }
+        if (!pollResponse.ok) {
+            throw new Error("Lore browser approval failed. Run connect --login again.");
+        }
+        const result = PollDeviceAuthorizationResponseSchema.safeParse(await pollResponse.json().catch(() => null));
+        if (!result.success) {
+            throw new Error("Lore returned an incompatible device authorization response.");
+        }
+        if (result.data.status === "pending") {
+            continue;
+        }
+        if (result.data.status === "approved") {
+            return result.data.token;
+        }
+        if (result.data.status === "denied") {
+            throw new Error("Lore access was denied in the dashboard.");
+        }
+        throw new Error("Lore browser approval expired. Run connect --login again.");
+    }
+    throw new Error("Lore browser approval expired. Run connect --login again.");
+}
+async function connectCommand(args) {
+    const parsed = parseConnectArguments(args);
+    if (parsed === null) {
+        return;
+    }
+    const paths = getLorePaths();
+    const existing = await readConnectorConfig(paths);
+    const hasProvidedToken = parsed.token !== undefined ||
+        (process.env.LORE_WORKSPACE_TOKEN?.trim() ?? "") !== "" ||
+        (process.env.LORE_TOKEN?.trim() ?? "") !== "";
+    const { apiUrl, dashboardUrl } = resolveConnectEndpoints({
+        ...(parsed.apiUrl === undefined ? {} : { apiUrl: parsed.apiUrl }),
+        ...(parsed.dashboardUrl === undefined
+            ? {}
+            : { dashboardUrl: parsed.dashboardUrl }),
+        environment: process.env,
+        existing,
+        preferHostedDefault: parsed.login || hasProvidedToken,
+    });
+    const configured = parsed.login
+        ? undefined
+        : configuredToken(parsed.token, existing);
+    if (parsed.login && hasProvidedToken) {
+        throw new Error("--login cannot be combined with an explicit or environment workspace token. Unset it or use the token directly.");
+    }
+    const token = parsed.login
+        ? await requestDeviceAuthorization({
+            apiUrl,
+            ...(dashboardUrl === undefined ? {} : { dashboardUrl }),
+            agents: parsed.agents,
+            openBrowser: parsed.openBrowser,
+        })
+        : configured;
+    if (token === undefined || token.trim() === "") {
+        throw new Error("Workspace token is required. Use --login, --token <token>, LORE_WORKSPACE_TOKEN, or LORE_TOKEN.");
+    }
+    const result = await connectWithCredential({
+        apiUrl,
+        ...(dashboardUrl === undefined ? {} : { dashboardUrl }),
+        token,
+        agents: parsed.agents,
+        ...(parsed.timeoutMs === undefined ? {} : { timeoutMs: parsed.timeoutMs }),
+    });
+    writeResult(result, parsed.json, `connected: ${result.agents.join(", ")}\napi_url: ${result.apiUrl}\nconfig: ${result.config}\n${result.warnings.map((warning) => `warning: ${warning}\n`).join("")}`);
 }
 async function queueCount(paths) {
     try {
@@ -1665,6 +2093,7 @@ async function statusData(paths) {
         reliability: reliability.inspection,
         reliabilityError: reliability.error,
         agents,
+        externalSurfaces: EXTERNAL_SURFACES,
     };
 }
 async function statusCommand(args) {
@@ -1676,10 +2105,13 @@ async function statusCommand(args) {
     const agentLines = data.agents
         .map((agent) => `${agent.agent}: ${agent.configured ? "configured" : "not configured"}, installation ${agent.installation.state}, invocation ${agent.invocation.state}${agent.invocationError === null ? "" : ` (${agent.invocationError})`}, capture ${agent.capabilities.captureDurability}, guard ${agent.capabilities.guardBoundaryCoverage}/${agent.capabilities.enforcement}`)
         .join("\n");
+    const externalSurfaceLines = data.externalSurfaces
+        .map((surface) => `${surface.surface}: repository template, locally inspectable no, capture ${surface.capabilities.captureDurability}, guard ${surface.capabilities.guardBoundaryCoverage}/${surface.capabilities.enforcement}`)
+        .join("\n");
     const metricRate = (value) => value === null || value === undefined
         ? "-"
         : `${(value * 100).toFixed(1)}%`;
-    writeResult(data, parsed.json, `connected: ${data.connected ? "yes" : "no"}\napi_url: ${data.apiUrl ?? "-"}\nconfig_mode: ${data.configMode ?? "-"}\nruntime: ${data.runtimeRequired ? (data.runtimeInstalled ? `installed (${data.runtimeVersion})` : data.runtimeVersion === null ? "missing" : `stale (${data.runtimeVersion})`) : "not required"}\ndurable_outbox: ${data.reliability?.outbox.total ?? 0} ready=${data.reliability?.outbox.ready ?? 0} auth_blocked=${data.reliability?.outbox.authBlocked ?? 0} dead=${data.reliability?.outbox.dead ?? 0}\noldest_capture: ${data.reliability?.outbox.oldestEnqueuedAt ?? "-"}\ncontext_snapshots: ${data.reliability?.cache.context ?? 0}\noldest_context_snapshot: ${data.reliability?.cache.oldestContextWrittenAt ?? "-"}\npolicy_snapshots: ${data.reliability?.cache.policy ?? 0}\nlocal_context_fallback_rate: ${metricRate(data.reliability?.operational.retrieval.fallbackRate)}\nlocal_guard_coverage: ${metricRate(data.reliability?.operational.guard.coverageRate)}\nlocal_guard_failures: ${data.reliability?.operational.guard.failures ?? 0}\nlocal_retrieval_failures: ${data.reliability?.operational.retrieval.failed ?? 0}\n${data.reliabilityError === null ? "" : `reliability_error: ${data.reliabilityError}\n`}${agentLines}\n`);
+    writeResult(data, parsed.json, `connected: ${data.connected ? "yes" : "no"}\napi_url: ${data.apiUrl ?? "-"}\nconfig_mode: ${data.configMode ?? "-"}\nruntime: ${data.runtimeRequired ? (data.runtimeInstalled ? `installed (${data.runtimeVersion})` : data.runtimeVersion === null ? "missing" : `stale (${data.runtimeVersion})`) : "not required"}\ndurable_outbox: ${data.reliability?.outbox.total ?? 0} ready=${data.reliability?.outbox.ready ?? 0} auth_blocked=${data.reliability?.outbox.authBlocked ?? 0} dead=${data.reliability?.outbox.dead ?? 0}\noldest_capture: ${data.reliability?.outbox.oldestEnqueuedAt ?? "-"}\ncontext_snapshots: ${data.reliability?.cache.context ?? 0}\noldest_context_snapshot: ${data.reliability?.cache.oldestContextWrittenAt ?? "-"}\npolicy_snapshots: ${data.reliability?.cache.policy ?? 0}\nlocal_context_fallback_rate: ${metricRate(data.reliability?.operational.retrieval.fallbackRate)}\nlocal_guard_coverage: ${metricRate(data.reliability?.operational.guard.coverageRate)}\nlocal_guard_failures: ${data.reliability?.operational.guard.failures ?? 0}\nlocal_retrieval_failures: ${data.reliability?.operational.retrieval.failed ?? 0}\n${data.reliabilityError === null ? "" : `reliability_error: ${data.reliabilityError}\n`}${agentLines}\n${externalSurfaceLines}\n`);
 }
 async function disconnectCommand(args) {
     const parsed = parseOutputArguments(args, DISCONNECT_HELP, "disconnect");
@@ -1821,6 +2253,19 @@ async function apiChecks(config) {
     }
     return checks;
 }
+async function verifyConnectedInstallation() {
+    const paths = getLorePaths();
+    const config = await readConnectorConfig(paths);
+    if (config === null) {
+        return false;
+    }
+    const status = await statusData(paths);
+    if (status.configMode !== "600" ||
+        status.agents.some((agent) => agent.configured && agent.installation.state !== "complete")) {
+        return false;
+    }
+    return (await apiChecks(config)).every((check) => check.status !== "error");
+}
 async function doctorCommand(args) {
     const parsed = parseOutputArguments(args, DOCTOR_HELP, "doctor");
     if (parsed === null) {
@@ -1899,6 +2344,13 @@ async function doctorCommand(args) {
                                 : "invocation health is unavailable",
         });
     }
+    for (const surface of status.externalSurfaces) {
+        checks.push({
+            name: `${surface.surface}-capability`,
+            status: "ok",
+            detail: "surface-specific repository configuration; local installation is not claimed",
+        });
+    }
     checks.push({
         name: "reliability-store",
         status: status.reliabilityError !== null
@@ -2016,7 +2468,19 @@ export async function runCli(args = process.argv.slice(2)) {
             await doctorCommand(commandArgs);
             return;
         case "self-host":
-            await runSelfHostCommand(commandArgs);
+            await runSelfHostCommand(commandArgs, process.env, {
+                connect: async (request) => {
+                    const connected = await connectWithCredential({
+                        apiUrl: request.apiUrl,
+                        token: request.token,
+                        agents: request.agents,
+                    });
+                    return {
+                        agents: connected.agents,
+                        verified: await verifyConnectedInstallation(),
+                    };
+                },
+            });
             return;
         case "demo":
             await runDemoCommand(commandArgs, await readConnectorConfig(getLorePaths()));